Merge 4.4.154 into android-4.4

Changes in 4.4.154
	sched/sysctl: Check user input value of sysctl_sched_time_avg
	Cipso: cipso_v4_optptr enter infinite loop
	vti6: fix PMTU caching and reporting on xmit
	xfrm: fix missing dst_release() after policy blocking lbcast and multicast
	xfrm: free skb if nlsk pointer is NULL
	mac80211: add stations tied to AP_VLANs during hw reconfig
	nl80211: Add a missing break in parse_station_flags
	drm/bridge: adv7511: Reset registers on hotplug
	scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
	drm/imx: imx-ldb: disable LDB on driver bind
	drm/imx: imx-ldb: check if channel is enabled before printing warning
	usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller()
	usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
	usb/phy: fix PPC64 build errors in phy-fsl-usb.c
	tools: usb: ffs-test: Fix build on big endian systems
	usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3'
	tools/power turbostat: fix -S on UP systems
	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
	qed: Fix possible race for the link state value.
	atl1c: reserve min skb headroom
	net: prevent ISA drivers from building on PPC32
	can: mpc5xxx_can: check of_iomap return before use
	i2c: davinci: Avoid zero value of CLKH
	media: staging: omap4iss: Include asm/cacheflush.h after generic includes
	bnx2x: Fix invalid memory access in rss hash config path.
	net: axienet: Fix double deregister of mdio
	fscache: Allow cancelled operations to be enqueued
	cachefiles: Fix refcounting bug in backing-file read monitoring
	cachefiles: Wait rather than BUG'ing on "Unexpected object collision"
	selftests/ftrace: Add snapshot and tracing_on test case
	zswap: re-check zswap_is_full() after do zswap_shrink()
	tools/power turbostat: Read extended processor family from CPUID
	Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum"
	enic: handle mtu change for vf properly
	arc: fix build errors in arc/include/asm/delay.h
	arc: fix type warnings in arc/mm/cache.c
	drivers: net: lmc: fix case value for target abort error
	scsi: fcoe: drop frames in ELS LOGO error path
	scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED
	mm/memory.c: check return value of ioremap_prot
	cifs: add missing debug entries for kconfig options
	cifs: check kmalloc before use
	smb3: Do not send SMB3 SET_INFO if nothing changed
	smb3: don't request leases in symlink creation and query
	btrfs: don't leak ret from do_chunk_alloc
	s390/kvm: fix deadlock when killed by oom
	ext4: check for NUL characters in extended attribute's name
	ext4: sysfs: print ext4_super_block fields as little-endian
	ext4: reset error code in ext4_find_entry in fallback
	arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
	KVM: arm/arm64: Skip updating PTE entry if no change
	KVM: arm/arm64: Skip updating PMD entry if no change
	x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
	x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM
	x86/speculation/l1tf: Suggest what to do on systems with too much RAM
	x86/process: Re-export start_thread()
	fuse: Don't access pipe->buffers without pipe_lock()
	fuse: fix double request_end()
	fuse: fix unlocked access to processing queue
	fuse: umount should wait for all requests
	fuse: Fix oops at process_init_reply()
	fuse: Add missed unlock_page() to fuse_readpages_fill()
	udl-kms: change down_interruptible to down
	udl-kms: handle allocation failure
	udl-kms: fix crash due to uninitialized memory
	ASoC: dpcm: don't merge format from invalid codec dai
	ASoC: sirf: Fix potential NULL pointer dereference
	pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
	x86/irqflags: Mark native_restore_fl extern inline
	x86/spectre: Add missing family 6 check to microcode check
	s390: fix br_r1_trampoline for machines without exrl
	s390/qdio: reset old sbal_state flags
	s390/pci: fix out of bounds access during irq setup
	kprobes: Make list and blacklist root user read only
	MIPS: Correct the 64-bit DSP accumulator register size
	MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
	scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
	scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
	iscsi target: fix session creation failure handling
	cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
	Linux 4.4.154

Change-Id: Ia008eef23c91fbd095f7b3343737cb2864875c52
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

3 files changed, 13 insertions, 3 deletions

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 97472088d65a..a1f1e53d0e25 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1401,6 +1401,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
 			goto cleanup_and_exit;
 		dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, "
 			       "falling back\n"));
+		ret = NULL;
 	}
 	nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
 	if (!nblocks) {
diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
index c2ee23acf359..ae9929d678d6 100644
--- a/fs/ext4/sysfs.c
+++ b/fs/ext4/sysfs.c
@@ -277,8 +277,12 @@ static ssize_t ext4_attr_show(struct kobject *kobj,
 	case attr_pointer_ui:
 		if (!ptr)
 			return 0;
-		return snprintf(buf, PAGE_SIZE, "%u\n",
-				*((unsigned int *) ptr));
+		if (a->attr_ptr == ptr_ext4_super_block_offset)
+			return snprintf(buf, PAGE_SIZE, "%u\n",
+					le32_to_cpup(ptr));
+		else
+			return snprintf(buf, PAGE_SIZE, "%u\n",
+					*((unsigned int *) ptr));
 	case attr_pointer_atomic:
 		if (!ptr)
 			return 0;
@@ -311,7 +315,10 @@ static ssize_t ext4_attr_store(struct kobject *kobj,
 		ret = kstrtoul(skip_spaces(buf), 0, &t);
 		if (ret)
 			return ret;
-		*((unsigned int *) ptr) = t;
+		if (a->attr_ptr == ptr_ext4_super_block_offset)
+			*((__le32 *) ptr) = cpu_to_le32(t);
+		else
+			*((unsigned int *) ptr) = t;
 		return len;
 	case attr_inode_readahead:
 		return inode_readahead_blks_store(a, sbi, buf, len);
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index b16bfb52edb2..a9b96d73d7d2 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -197,6 +197,8 @@ ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end,
 		struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e);
 		if ((void *)next >= end)
 			return -EFSCORRUPTED;
+		if (strnlen(e->e_name, e->e_name_len) != e->e_name_len)
+			return -EFSCORRUPTED;
 		e = next;
 	}